The Ultimate Guide to Prompting: From Examples to Engineered Systems

A translation task becomes a research program

Sander Schulhoff’s first prompting problem was to translate between a Diplomacy-specific bot language and English using GPT-3. After several years building data-collection and machine-learning infrastructure for a Maryland Diplomacy project, he was using a model to tackle the translation itself.

A parallel project introduced him to competitions. Working with MineRL for Minecraft reinforcement learning, Schulhoff could not find documentation for custom environments. He read the codebase, contributed the missing documentation, and joined the team for about a year, helping maintain the library and run its annual competition.

Learn Prompting began as an English-class assignment to write a guide. Prompting techniques were scattered across blog posts; Schulhoff wanted one place to collect them. He and Alessio place its launch around October 2022, before ChatGPT. After encountering discussions of prompt injection, he drew on his competition experience to organize HackAPrompt in May 2023. He reports collecting 600,000 malicious prompts, releasing the outputs openly, and producing a paper that received best-paper recognition at a natural-language-processing conference.

The Prompt Report extended the collection into a systematic survey. Schulhoff describes roughly 30 researchers spending nine months reading thousands of papers and assembling an approximately 80-page document. Its organizing question is useful for practitioners: how does each prompting technique approach a problem?

Organize techniques by what they do

Schulhoff recalls encountering an apparently relevant survey whose prose made little sense and whose authors disclosed using ChatGPT to generate paragraphs. He considered generating an entire paper beyond the acceptable boundary, while leaving smaller amounts of writing assistance unresolved. The review team used AI for a narrower, checked task: screening papers for relevance and comparing those decisions against human evaluations.

The team followed a formal systematic-review process to make its search more comprehensive and reduce the chance of missing important work. The process added time, but supplied a method for searching and screening rather than relying on a long reading list alone.

The taxonomy groups techniques by problem-solving strategy, since the same technique can apply across many domains: - Thought generation asks for intermediate reasoning steps, as in chain-of-thought. - Ensembling combines responses to the same problem. - Self-criticism generates an answer, critiques it, and revises it. - Decomposition identifies and individually solves subproblems. - Few-shot prompting supplies examples, also called exemplars; zero-shot prompting supplies none.

These categories overlap. Few-shot chain-of-thought uses examples and intermediate reasoning; the report assigns it primarily to thought generation, treating examples as an enhancement. Zero-shot also serves as a catch-all for techniques outside the other categories. The labels make the collection navigable without implying mutually exclusive mechanisms.

Personas change style; expertise is a separate claim

Persona prompting asks a model to adopt a character or perspective. Pirate-like speech specifies a style; a brilliant mathematics-professor persona attempts to improve correctness. One participant argues that the latter is not reliably useful on GPT-4-class models, with possible benefits on older models described as anecdotal. This criticism concerns assumed personas, distinct from API message roles such as system, assistant, and user.

In a reported mini-study, a persona described as incompetent at mathematics outperformed a Harvard-educated mathematics-professor persona on a recalled couple thousand benchmark questions. The study was absent from the then-current report, and no exact model, scores, or significance tests are given. The result challenges the intuition that prestigious credentials improve answers; it does not establish an advantage for insulting the model. The same participant questions whether tipping and emotional-pressure prompts would hold up under proper benchmarking.

Other participants identify a different purpose for roles: diversity of perspectives. Examples include persona-generated synthetic data and an ensemble attributed to Chenglei Si, in which models answer under different roles before a majority response is selected. One participant in that ensemble can have retrieval or internet-search access. These approaches diversify candidate solutions and available information; the skeptical position remains specifically about persona-based accuracy gains on modern models.

Examples teach structure—and can leak into answers

Few-shot prompting makes example order part of the design. Put every negative example before every positive example, and the model may continue the recent run of positives. The recommendation is to test different orders and generally randomize them rather than assume the sequence is neutral.

Formatting matters too. Familiar patterns such as Q: / A: or input: / output: are recommended on the hypothesis that frequent exposure during training makes behavior more stable. Prompt mining searches a dataset for common question-and-answer formats and adopts them for examples. Its practical limit is access to training data, which is unavailable for ChatGPT.

A participant producing a daily AI newsletter describes exemplar leakage: content intended only as a demonstration reappears in the generated newsletter. Pairing good and bad examples did not prevent it. Neither did an explicit instruction against repeating examples in that workflow. The report had not covered this failure, and the discussion leaves it unresolved.

One possible connection is that examples convey both content and structure. A participant cites research suggesting that, in some classification settings, the output pattern matters more than individual label correctness. A positive sentence incorrectly labeled negative may have only a limited effect. Incorrect labels still reduce performance, however; this is no reason to disregard example quality.

For some prompts, the newsletter practitioner obtained better results by removing demonstrations and supplying a fill-in-the-blanks template with placeholders. That experience suggests a practical comparison: does the task need examples, or does it mainly need an explicit output shape? More examples need not improve the result.

Generate reasoning, then decide what to trust

Several thought-generation techniques amount to chain-of-thought with different wording; Thread of Thought is one example discussed. The names can obscure the shared mechanism, but testing several formulations helps determine whether a result depends on a particular phrase. Complexity-based chain-of-thought changes selection too: sample reasoning paths, retain the longer ones, and ensemble their answers. Its rationale—that longer paths are more likely to be better—is a hypothesis, not a guarantee of correctness.

A specialist dataset illustrates how reasoning examples can be generated when expert time is scarce. The researcher had expert-labeled inputs and outputs but no accompanying explanations: 1. Ask ChatGPT or GPT-4 to solve an input step by step. 2. Compare the final answer with the known label. 3. Retain matching answers and their reasoning as few-shot examples. 4. For failures, return the failed answer and conversation history and try requesting rewritten reasoning. The known label checks the final answer. It does not independently validate the explanation, and no downstream performance measurement is supplied for this workflow.

Do these instructions become redundant as models improve? The questioner reports that Sonnet 3.5 often generates intermediate reasoning without being asked. Another participant recalls reasoning-free outputs roughly once per hundred to thousand GPT-4 API calls and considers an explicit step-by-step request worthwhile for their tasks. That request is not a demonstrated guarantee; it selects a desired behavior from a general-purpose model that supports many modes.

Orca and Evol Instruct are suggested as work on training reasoning behavior into models. A participant describes a recurring pattern in which successful prompting techniques become synthetic training data. As developers absorb those behaviors, the instructions that help may change, while applications still need to specify the behavior they require.

Separate decomposition, voting, and revision

Decomposition can start with a simple instruction: identify subproblems and solve each individually. A more elaborate implementation assigns separate API calls to the subproblems and returns their results to a main prompt. Tree of Thought receives a favorable assessment for several unspecified tasks, with implementation complexity and execution time limiting its practicality.

The proposed distinction is between writing intermediate reasoning steps and identifying subproblems to solve individually. The boundary remains imperfect—even the report’s contributors disagreed about it—but decomposition provides a natural route from a single prompt to a workflow of separate calls.

Prompt ensembling sends the same question through different prompts and usually selects the majority answer. Self-consistency samples different responses to the same prompt, using a somewhat high temperature to encourage variation. It can be implemented as repeated prompt instances or as decoding several paths from one prompt; the latter is described as generally more efficient.

A participant reports little change from self-consistency in the paper’s evaluations and suspects its benefit has declined as models improved. Larger sampling budgets are suggested as a possibility, without results establishing that they help.

Self-criticism instead follows an answer–critique–revision sequence. Majority voting requires no critique. A third approach passes several reasoning paths to another prompt for synthesis, with the hope that the model can recover useful information that a vote would discard. That potential advantage is proposed without a comparative measurement.

Count engineering time as well as tokens

When several calls contribute to one answer, where to use the stronger model becomes a design question: generating candidates, judging them, or synthesizing the result. For a one-off research project, one participant recommends paying for a capable model rather than spending substantial engineering time on routing. Larger usage volumes and experienced staff can make routing more worthwhile. The discussed research projects also benefited from OpenAI credits, so the lab did not pay those API costs itself.

A summarization practitioner describes generating varied drafts with GPT-4o mini and judging them with GPT-4o. They report that ten mini calls plus judging cost less than using GPT-4o throughout, citing input prices at the time of $0.15 versus $5 per million tokens. The example comes without full token accounting or a measured quality comparison, so the savings depend on the workflow.

Automated prompt optimization changes the engineering-time calculation. One researcher reports spending 20 hours manually engineering a prompt, then being beaten by DSPy in ten minutes. The task, metric, and margin are unspecified, but the experience changed their view of automation. They recommend its Python tooling while emphasizing that the optimization workflow needs ground-truth labels—known correct outputs—which makes open-ended newsletter writing harder to optimize.

Meta-prompting, asking a model to improve an existing prompt, is mentioned as another approach, though its effectiveness is left uncertain. The broader discussion treats prompting as a widely useful skill and AI engineering as the work of assembling systems with code. Dedicated prompting specialists may still make sense at AI companies whose customers need that expertise.

HackAPrompt: exact-output failures reveal new attacks

The security discussion begins with disputed terminology. A participant who wrote the HackAPrompt paper recalls correcting its definitions after clarification from someone identified as Simon. Their adopted distinction is that prompt injection pits user input against developer instructions, while jailbreaking concerns the user and model without developer instructions. Layered applications complicate that distinction, so they use prompt hacking as a catch-all.

HackAPrompt’s analysis reportedly identified 29 attack techniques. The organizer credits its community, leaderboard, and participant discussions with encouraging unexpected discoveries. One was context overflow, which exploited an exact-output requirement: the model had to return a target phrase alone. Surrounding whitespace was acceptable; punctuation or explanation caused failure.

Contestants could elicit the phrase but struggled to suppress extra commentary. They reportedly supplied roughly 4,000 tokens of slashes or random characters followed by the malicious instruction. In the speaker’s account, this exhausted enough of the available context budget to allow the target phrase while preventing a continuation. The discovery depended on the challenge’s resource limits; the model and configuration are not specified.

Another challenge made both its target string and output limit 196 characters long, demanding a response with nothing extra. This leads to prompt golf: solving a task with the smallest prompt, analogous to code golf. Randomness in model outputs and difficulty enforcing exact word, sentence, or token counts make such solutions less reproducible.

Multimodal prompting tests controllability

Music generation supplies a concrete production use: custom podcast intros made with Suno or Udio. Another participant liked Udio’s voices, while a friend disliked its guitar riffs. Initial enthusiasm did not become continued use because the participant lacked an application for the tool.

Video exposes a sharper gap between impressive output and precise control. A participant asked Gen-3 for one sphere splitting into two, received unrelated animations, and handed the task to a colleague with stronger video-prompting skills. Their hands-on experience concerned Gen-3; they had only viewed Sora examples. They attribute the difficulty to video’s additional axes of freedom: a specific instructional animation can be much harder to obtain than an appealing clip.

Inspect the prompts and evaluate the evaluator

One participant prefers direct model API calls with surrounding code because frameworks can conceal consequential instructions. A summarization helper may contain its own prompt; without visibility into it, unexpected outputs become harder to explain and research methods harder to reproduce.

Structured output, which constrains the form of a response, raises a separate question about quality. A participant recalls an unnamed paper reporting reduced accuracy and creativity when structure was forced. They leave open whether that finding applies to OpenAI’s then-new structured-output functionality, since model training could change the outcome.

A valid response shape does not make a judgment meaningful. A participant recalls a medical-chatbot demo that prioritized patient messages using model judgments, token probabilities, and numerical scores. Their criticism is that models can favor particular numbers and lack a stable interpretation of an unspecified scale. Define each score’s meaning—for example, explicit levels of urgency—rather than asking for an unexplained one-to-ten rating.

The participant also questions using output-sequence probabilities as evaluation scores, citing failures in unspecified studies. The practical requirement is to evaluate the evaluator itself, especially when judgments affect medical prioritization. A numerical output still needs evidence that it measures the intended property.

The next security boundary is what an agent can do

At the conversation’s close, Sander describes HackAPrompt 2 as still being planned and fundraising toward $500,000 in prizes. Its intended scope extends from exact phrases to real-world harms, including misinformation and harassment, and to agent security failures. The goal is to produce material for safety tuning and benchmarking.

Sander illustrates the risk with a hypothetical email-management agent: an incoming message tells it to delete all email, and it obeys. Received content has become an instruction with destructive authority. Removing the ability to delete email is a straightforward mitigation, but useful agents need capabilities that carry consequences. The planned competition aims to test those practical boundaries, including the risk of agents escaping their sandboxes, using lessons from the original HackAPrompt and other competition organizers.